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Introduction 


1.1 


1.2 


1.3 


Our ambitions for the DRCF represent a true innovation in the breadth and depth of 
cooperation between regulators. We see this cooperation as essential to ensuring that the 
regulation of digital services delivers fully for consumers and citizens and works well for 
businesses. In November of 2020, the UK Government asked the CMA, ICO and Ofcom (the 
members of the DRCF at that time) to give their view on the challenges of delivering 
effective digital regulation and whether further measures may be needed to support 
cooperation between digital regulators. Although the FCA joined the DRCF on 1 April 2021, 
this document sets out the views of the CMA, the ICO and Ofcom on these issues. 


Consumers and business rightly expect regulators to be joined up and by working together, 
we will be better able to respond to the scale and global nature of large digital platforms and 
the speed at which they innovate. Through the DRCF workplan for 2021-22 we plan to 
engage with our key shared challenges, in the absence of legislative change, recognising this 
as the fastest route to securing benefits. Our cooperation through the DRCF will help us 
provide policy coherence in the public interest, respond strategically to industry and 
technological developments, and build shared skills and capabilities. 


With the DRCF already up and running, we are confident that we can engage with these 
challenges and deliver benefits through our existing cooperation work. However, we also 
recognise the potential limitations of a voluntary approach. It is right to consider whether 
further measures are needed. To be effective, long term, we see potential barriers to our 
cooperation and joint working that need to be addressed, and possibly the need to develop 
a legislative framework that embeds cooperation in the digital regulatory landscape. 


1.4 In this document we provide a summary of our ideas to address barriers to cooperation, and 
measures to strengthen digital regulatory cooperation in the future. In our view, the 
Government may want to consider measures to support cooperation between digital 
regulators in the following three areas: 


supporting appropriate information sharing; 


embedding coherence and cooperation in the statutory framework for digital services; and 


providing transparency and accountability. 


1.5 Establishing an appropriate framework for cooperation between regulators is ultimately a 
matter for the Government, and we welcome further discussion on this. Below we set out 
further details on the areas identified above. At the end of this document we provide a 
summary of our recommendations. 


Supporting appropriate information sharing 


1.6 The ability of digital regulators to appropriately share information, where necessary to carry 
out their functions, will be key to effective cooperation across the digital regulatory 
landscape. The existing rules around legislative ‘information sharing gateways’ were 
primarily designed to provide a vehicle for a regulator to share information for its own 
purposes and to allow a narrow route for information to be passed on, by request, from one 
agency for another agency’s purposes. Information sharing gateways do not generally 
provide for the disclosure of information for the purposes of joint or coordinated activities. 


1.7 We recommend that the Government reviews the information sharing gateways between 
digital regulators to ensure that they are suitable for future expected cross-regulatory 
engagement, and appropriately supportive of regulators’ actions in carrying out their 
functions with respect to online operators. The objectives of a revision would be to: 


° maximise the potential for regulatory collaboration by facilitating the exchange of data and 
other information held by regulators for the purposes of cross-cutting work; 


° ensure that the legitimate interests of stakeholders in respect of their information are 
protected, and reassure stakeholders regarding the treatment of confidential information; 


° remove uncertainty and minimise legal risk in sharing information; 
° facilitate development of a shared understanding of policy issues between regulators; and 
° underpin any other new measures that support the aims of cooperation between digital 


regulators, by embedding the means for cooperation into the administrative processes of 
relevant regulators. 


t There may be instances where it is appropriate for a regulator to disclose information for such activities 
where it is necessary for the purpose of exercising its own functions (e.g. the allocation of cases where 
regulators have concurrent powers). 


1.8 


1.9 


1.10 


1.11 


By sharing relevant information, regulators will be able to work jointly on cross-cutting 
issues or share expertise. As set out in our workplan, we already intend to update our 
Memoranda of Understanding (or ‘MoUs’) to ensure that they reflect any new 
responsibilities for digital regulation, the potential for multilateral joint projects, and the 
aims of coordination in online regulation. However, MoUs are voluntary agreements 
between regulators, intended to provide clarity for regulators and their stakeholders. They 
do not change the underlying legal frameworks for information sharing. 


In order to maximise the potential of joint work on strategic projects and specific regulatory 
activities, as well as deliver innovative and impactful outcomes, improved provisions for 
information sharing are needed. At the least, this might require a change to the Enterprise 
Act to add an information gateway for the purposes of cooperating on digital regulatory 
matters, listing the relevant functions of the ICO, Ofcom and the DMU. 


A more expansive approach to revising gateways aimed at supporting collaboration across 
the wider regulatory landscape could also be considered. For example, putting in place 
legislative provisions to support information sharing for the purposes of joint or coordinated 
working between a wider range of digital regulators. However, the implications for industry 
confidence and clarity as well as any impact on the function of other regulators would need 
to be carefully considered in conjunction with any benefits for digital regulatory 
cooperation. 


In making any changes to information sharing gateways, the Government would need to 
ensure that there remain appropriate checks and balances on information disclosure. Such 
controls are essential to ensure that the companies who are required to share information 
with us have full confidence that their legitimate interests are protected with respect to 
confidential information. Appropriate controls on information sharing and the treatment of 
confidential information are already recognised in legislation and any wider sharing of 
information beyond the purpose for which it was collected should be similarly subject to 
controls. 


Current information sharing arrangements between ICO, CMA and Ofcom 
Part 9 of the Enterprise Act 2002 (‘the Act’) imposes a general restriction on the disclosure of 
information relating to the affairs of an individual or any business of an undertaking (‘specified 
information’) by a public authority, which it acquires in connection with the exercise of its functions 
under the Act or any of the legislation listed in Schedule 14 to the Act, which includes the 
Competition Act 1998. 


Public authorities are permitted to disclose specified information via certain ‘gateways’, including (i) 
with the consent of the individual or business that provided the information; (ii) to a person for the 
purpose of facilitating the exercise by the authority of any of its own statutory functions, or (iii) to a 
person for the purpose of facilitating the exercise by that person of any function he has under the Act 
or any of the legislation listed in Schedule 15 to the Act, which includes the Competition Act 1998 and 
the Communications Act 2003. The information must not be used by the person to whom it is 
disclosed for any other purpose than in relation to those statutory functions. 


When disclosing specified information, the public authority must exclude any information whose 
disclosure (i) it regards as contrary to the public interest, (ii) it thinks might significantly harm the 
legitimate business interests of the undertaking to which it relates, or (iii) it considers might 
significantly harm the interests of the private individual to whom it relates. The authority must also 
consider the extent to which the disclosure of the information is necessary for the purpose for which 
it is permitted to make the disclosure. 


By virtue of these legislative provisions, the CMA and Ofcom may disclose specified information to 
each other in order to facilitate the other’s exercise of its functions under the Act or other specified 
legislation. However, the list of specified legislation does not include the ICO’s functions under 
UKGDPR or the Data Protection Act 2018, so the ability of the ICO to receive and disclose information 
is inconsistent with that of the other DRCF partners. Ofcom also has specific gateways for information 
sharing under the Communications Act 2003 but again these are limited to facilitate the carrying out 
of particular functions by Ofcom or another person, rather than to enable joint or coordinated 
working. 


The disclosure of information by the ICO is governed by the Data Protection Act 2018, which prohibits 
the disclosure of confidential information which has come to the ICO in the course of carrying out its 
functions unless it is made with lawful authority. Lawful authority includes (among other things) a 
disclosure that is made for the purposes of, and is necessary for, the discharge of the Commissioner’s 
functions or where, having regard to the rights, freedoms and legitimate interests of any person, the 
disclosure was necessary in the public interest. The Data Protection Act 2018 also confirms that in 
most circumstances no other law which prohibits or restricts the disclosure of information will 
preclude the sharing of information with the ICO where to do so is necessary for the discharge of the 
Commissioner’s functions. 


Embedding coherence and cooperation in the statutory framework for digital services 


1.12 The duties and objectives of regulators play an essential role in setting out the scope of 
issues that individual regulators can consider as they exercise their functions. We 
recommend that the Government adopts measures to incorporate regulatory coherence and 
cooperation into the duties of digital regulators. The objective of such changes would be to: 


1.13 


1.14 


1.15 


1.16 


1.17 


address any risks that the duties and objectives of digital regulators impede the delivery of 
coherent regulatory decisions; and 


ensure that digital regulators are incentivised and empowered to put in place mechanisms 
to support cooperation in the future. 


The objectives of the CMA, the ICO and Ofcom span areas such as promoting competition, 
the regulation of communications services, and the protection of people’s data rights. This 
means that as we carry out our work, potential interactions will need to be appropriately 
surfaced and addressed to make sure that our individual regulatory solutions take due 
account of our range of perspectives. For example, the CMA’s Google Privacy Sandbox 
investigation, described in our workplan, presents interlinkages between data protection 
and competition. 


We see a risk that the current statutory framework may impede digital regulators’ ability to 
cooperate effectively and deliver coherent solutions. One concern is that digital regulators’ 
duties and objectives could limit how effectively they can give due weight to policy concerns 
outside of their remit, even where such concerns are relevant to supporting coherent 
outcomes. 


To make sure that the regulation of digital services is fit for purpose in the future it may also 
be appropriate to embed the aims of cooperation into the statutory framework. This would 
ensure that identifying, surfacing and addressing interlinkages between digital policy issues 
continues to be a priority for digital regulators, and that they are empowered to put in place 
the appropriate mechanisms for cooperating to support this goal. 


We have considered the following potential options: 
aligned supplementary duties; 

duties to consult; and 

duties to cooperate. 


We explain these duties in more detail below, as well as further considerations for the 
implementation of any new duties to support cooperation. 


Aligned supplementary duties 


1.18 


As described above, an important challenge for effective digital regulation will be ensuring 
coherence between the regulatory actions taken by different regulators that effect digital 
services. Government could consider taking action to ensure that, in pursuit of their own 
objectives, regulators are able to take into account the impact of their actions on other 
regulatory objectives outside of their functions. One approach to delivering this would be 
through a common set of supplementary duties, for example to ‘promote the interests of 
consumers and citizens.’ Together with the duty to cooperate (set out further below) this 
could provide regulators with a strong basis to work together to deliver outcomes in the 
overarching interests of consumers and citizens. 


1.19 


1.20 


1.21 


Currently the duties of the CMA, the ICO and Ofcom vary, both in their broad purpose and as 
to whether they require regulators to consider benefits to consumers (CMA), consumers and 
citizens (Ofcom) or data subjects (ICO). This reflects the scope and purpose of our respective 
functions. For example, the duties of the CMA reflect its role in promoting competition 
across the economy, while the duties of the ICO reflect its role in upholding people’s 
information rights. As set out in our implementation considerations below, careful 
consideration would be needed to ensure that any new aligned supplementary duty is 
implemented in a way that did not unduly impact the scope or focus of regulators regarding 
their existing functions and duties. 


The Digital Markets Taskforce (DMT) also considered this issue in its advice to government 
on a new Digital Markets Unit (DMU). The DMT explained that the DMU might need to 
consider a range of issues beyond promoting competition. For example, the DMU might 
need to take into account where action to promote competition could have implications for 
citizen’s data rights. For this reason, the DMT suggested that that regime should have a duty 
to promote the interest of consumers and citizens through competition and innovation.” 


Ofcom’s principal duty provides a useful example of how a duty to ‘promote the interests of 
citizens and consumers’ can link across a range of policy objectives that affect the users of 
communications services and society as a whole.? Under Ofcom’s principal duty, it can take 
into account a range of policy objectives, such as ensuring that there is effective competition 
between telecoms service providers and making sure that there is a range of companies 
providing quality television and radio programmes that appeal to diverse audiences in the 
UK. 


Duty to consult 


1.22 


1.23 


To support the transparency and effectiveness of consultations between regulators, the 
Government may wish to consider the benefits of specific obligations on regulators to 
consult with, and take account of, other agencies with expertise relevant to the decision 
being made. 


As described above, there will be circumstances where regulators need to work together to 
deliver coherent outcomes. For example, where a competition authority, in pursuing pro- 
competition measures, needs to consider potential interactions with data protection, as 
noted in our workplan for 2021-22. We are, of course, alive to such concerns and each have 
clear legal obligations to undertake impact assessments as part of any consideration of a 
new action. We also have a general duty to consult and it is possible for individual agencies 
to respond to relevant consultations. More generally, we expect our close working through 
the DRCF to help expose issues which raise cross-regulatory policy concerns. 


2 CMA, December 2020, A new pro-competition regime for digital markets: Advice of the Digital Markets 
Taskforce. 


3 UK Government, The Communications Act 2003, Section 3: General Duties of Ofcom. The Act outlines that 
Ofcom’s principal duty, in carrying out its functions shall be— 

(a)to further the interests of citizens in relation to communications matters; and 

(b)to further the interests of consumers in relevant markets, where appropriate by promoting competition. 


1.24 Despite our general duties to consult, we expect that there might be circumstances where 
specific formal engagement between regulators on a proposed action may be warranted. 
For example, where specific expertise or evidence plays an important role in a regulatory 
decision. In these cases, it will be important for consumers and for industry that such 
engagement is transparent, and that affected parties are able to understand and engage 
with these regulatory considerations. A duty to consult could also create better legal 
certainty for industry and regulators regarding the circumstances under which digital 
regulators may take into account the impact of their actions on wider policy concerns 
outside of their direct remit. 


1.25 A specific duty for digital regulators to consult each other, where appropriate, regarding 
digital regulatory matters could ensure that these processes are carried out and with due 
transparency. 


Duty to cooperate 


1.26 The Government could further support regulatory coherence through placing a duty to 
cooperate on digital regulators. As described above, we see effective cooperation between 
digital regulators as essential for delivering coherent outcomes for people using digital 
services. Aligned supplementary duties combined with a duty to consult could help digital 
regulators formally seek input from each other and appropriately take account of responses. 
However, we recognise that digital regulators are likely to need to cooperate beyond this 
formal consultation. For example, to share information where appropriate and the ability to 
seek advice outside of formal consultation approaches. 


1.27 Any duty to cooperate should provide explicit recognition of the need to take such action 
and support regulators in putting in place appropriate mechanisms to deliver coherent 
digital policy and ensure that they remain a priority in the future. Explicit duties to cooperate 
have been used in other regulatory situations. For example, cooperation is embedded in the 
legislation of regulatory authorities in the financial sector.* 


4 The Financial Service and Markets Act 2000 has a number of specific articles that embed cooperation into the 
heart of the duties of the FCA, PRA and Bank of England. 


Duties to cooperate included in the Financial Services and Markets Act 


Section 3q Co-operation by FCA with Bank of England 

(1) The FCA must take such steps as it considers appropriate to co-operate with the Bank of England in 
connection with— 

(a) the pursuit by the Bank of its Financial Stability Objective, and 

(b) the Bank's compliance with its duties under sections 58 and 59 of the Financial Services Act 2012 
(duty to notify Treasury of possible need for public funds and of subsequent changes). 

(2) Co-operation under subsection (1) may include the sharing of information that the FCA is not 
preventing from disclosing 


Section 13D Duty of FCA and PRA to ensure co-ordinated exercise of functions 


(1) The regulators must co-ordinate the exercise of their respective functions conferred by or under 
this Act with a view to ensuring— 

(a) that each regulator consults the other regulator (where not otherwise required to do so) in 
connection with any proposed exercise of a function in a way that may have a material adverse effect 
on the advancement by the other regulator of any of its objectives; 

(b) that where appropriate each regulator obtains information and advice from the other regulator in 
connection with the exercise of its functions in relation to matters of common regulatory interest in 
cases where the other regulator may be expected to have relevant information or relevant expertise; 
(c) that where either regulator exercises functions in relation to matters of common regulatory 
interest, both regulators comply with their respective duties under section 1B(5)(a) or 2H(1)(a), so far 
as relating to the regulatory principles in section 3B(1)(a) and (b). 

(2) The duty in subsection (1) applies only to the extent that compliance with the duty— 

(a) is compatible with the advancement by each regulator of any of its objectives, and 

(b) does not impose a burden on the regulators that is disproportionate to the benefits of compliance. 
(3) A function conferred on either regulator by or under this Act relates to matters of common 
regulatory interest if— 

(a) the other regulator exercises similar or related functions in relation to the same persons, 

(b) the other regulator exercises functions which relate to different persons but relate to similar 
subject-matter, or 

(c) its exercise could affect the advancement by the other regulator of any of its objectives. 

(4) “Objectives”, in relation to the FCA, means operational objectives. 


Implementing new duties 


1.28 The implementation of any new duties or objectives to support cooperation would require 
careful consideration to avoid unintended consequences. This includes ensuring coherence 
between any new duties or objectives, ensuring that there was no conflict or ambiguity with 
respect to the existing legislative frameworks of relevant regulators, and avoiding undue 
increases in the burden on regulators and associated impacts on decision-making time. 


1.29 Any new duties would also need to be implemented in a way that provided clarity that there 
is no intention to expand the scope of the individual regulator’s functions beyond their 
primary purpose. The duties should act to inform the scope of considerations that can be 


taken into account in the performance of those functions and the use of the regulatory tools 
provided. However, the justification for action should always remain rooted in regulators’ 
primary functions (i.e. competition authorities to act in the interest of promoting 
competition and innovation and privacy regulators to protect privacy rights etc). 


1.30 Digital regulators should also be obliged to provide transparency regarding where and how 
any wider considerations outside of their primary remit are taken into account. For example, 
where any of Ofcom’s general duties conflict with each other, Ofcom is empowered to 
resolve that conflict in the manner that they think best in the circumstances. Where this is 
an important case it must publish a statement setting out: (a) the nature of the conflict; (b) 
the manner in which it has decided to resolve it; and (c) the reasons for its decision to 
resolve it in that manner. It may be appropriate for digital regulators to also be obliged to 
provide similar transparency on important matters.° 


1.31 The Government may also need to consider how any additional duties, such as a duty to 
consult other digital regulators, are implemented in ways that do not unduly hamper 
regulators working efficiently to deliver timely decisions. One way to streamline any 
additional consultations would be to ensure that they are conducted concurrently with any 
industry consultation. We also anticipate that it would be necessary to limit the scope of any 
duties to appropriate ‘digital matters.’ Given potential challenges in defining digital matters, 
ensuring proportionality may also require allowing for regulatory discretion. For example, 
with regard to a duty to consult, regulators may need discretion to determine which issues 
require such consultation, perhaps with an additional obligation to explain where, in the 
regulator’s view, consultation was not appropriate. 


Transparency and accountability 


1.32 Transparency and accountability are important levers to ensure that cooperation between 
digital regulators is effective, and deliver results for consumers, data subjects and citizens. 
By understanding and engaging with our agenda, industry and the wider public can have 
clarity on the scope of our work and help provide a challenge function. Our public workplan 
for 2021-22 sets the tone for our increasing public engagement and we expect increasing 
input and engagement from industry, wider stakeholders and the public. We will continue to 
build on this approach through an annual planning and reporting process, so that our plans 
for cooperation are clear, and we are held to account on our ambitions. 


1.33 We also see merit in the Government considering mechanisms to enable it to input on its 
strategic priorities as they relate to digital services and platforms. There are existing 
established approaches for the Government to set out its strategic priorities that are 
relevant for regulators, such as the Statement of Strategic Priorities that the Government 
produces in relation to telecommunications, the management of radio spectrum, and postal 
services. Ofcom has duties to take into account such statements when carrying out relevant 
functions, explain what it intends to do as a consequence of these statements, and publish a 


5 UK Government, The Communications Act 2003, Section 3: General Duties of Ofcom. 


1.34 


review of progress over the relevant period.® This approach is clear and transparent and 
does not create additional risk in terms of regulators’ ability to reach independent decisions. 


Our suggestions for formalising regulatory objectives and duties could also enhance the 
transparency and accountability of our cooperation, for example setting out a clear 
articulation of the Government’s view of the desirable scope of digital regulatory 
cooperation, and by clearly setting out how and when regulators address interactions 
between different regulatory remits. 


Other mechanisms for supporting coherence in digital regulation 


1.35 


1.36 


1.37 


Prior to the introduction of the DRCF, the House of Lords recommended establishing a new 
Digital Authority’ and Doteveryone proposed a new body called the Office for Responsible 
Technology.® The proposed objectives of these new digital bodies include building digital 
regulatory capacity, bringing together different policy perspectives to horizon scan and 
support coherence, and providing transparency, accountability and oversight of digital 
regulation. 


As set out in this document, we see a real need for digital regulatory policy to be considered 
holistically and that shared challenges are addressed collectively. However, we also see risks 
associated with establishing a new digital body. To be effective, a new digital body would 
need appropriate expertise. There is a risk that building this capacity results in inefficient 
duplication and missed opportunities to leverage the existing skills of digital regulators. A 
new body focused solely on digital matters may also miss connections with the regulation of 
traditional sectors and services. In a fast-moving industry and policy context, additional 
layers of input and decision-making risk inadvertently slow down regulatory approaches and 
reduce clarity and certainty for industry. 


In our view, an approach built on cooperation between digital regulators, such as the DRCF, 
is likely to be more efficient and effective. The DRCF will remain inherently plugged in to the 
concerns of people using digital services through its member’s activities and research, can 
leverage their industry engagement, and can build on existing regulatory skills and 
capabilities. By harnessing our collective expertise, we can ensure that the digital landscape 
is regulated effectively, coherently and efficiently and that regulatory policy is developed in 
a responsive and holistic way. As described in our DRCF workplan, we see our cooperation 
bringing benefits for consumers, for businesses and to innovation. To support the ongoing 
transparency and accountability of the DRCF, we will publish an update and report on 
progress on our DRCF workplan for 2021-22 in 12 months.? 


5 UK Government, The Communications Act 2003, 2A Statement of strategic priorities. 

7 UK Parliament, 2019, Chapter 6: The Digital Authority. 

8 Doteveryone, 2018, Regulating for Responsible Technology: Capacity, Evidence and Redress: a new system 
for a fairer future. 

° DRCF, March 2021, Plan of work for 2021-2022. 
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Summary of recommendations and options 


1.38 


The DRCF will allow us to be agile and to act with pace to deliver coherent regulation in the 
public interest, while still providing transparency and accountability for industry and wider 
stakeholders. Building on this approach, through further measures to strengthen this 
cooperation, could help ensure that the digital regulatory landscape is fit for purpose in the 
future. Our recommended actions and options for the Government to consider are set out 
below. 


Recommendation 1: that the Government review information sharing gateways of digital 
regulators to ensure that they are suitable for expected cross-regulatory engagement in the 
future, and support the actions of our regulators in their functions with respect to online 
markets. 


Recommendation 2: that the Government adopts measures to incorporate regulatory 
coherence and cooperation in the duties of digital regulators. Options include: 


aligned supplementary duties, for example to promote benefits for consumers, data subjects 
and citizens; 


duties to consult; and 
duties to cooperate. 


We also see merit in the Government considering mechanisms that allow it to provide input 
on its strategic priorities with respect to digital services and platforms. 
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